summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2008-08-26 10:27:00 +1000
committerAndrew Bartlett <abartlet@samba.org>2008-08-26 10:27:00 +1000
commit7f86b26a35e86139b991d42b61321cbc8fa68416 (patch)
tree3f08ccb624ddcc32f23c3c837dcbca9d75aa16a0
parent291b0dfb2a9cfff94e21c9cd17aa00345219765c (diff)
downloadsamba-7f86b26a35e86139b991d42b61321cbc8fa68416.tar.gz
samba-7f86b26a35e86139b991d42b61321cbc8fa68416.tar.bz2
samba-7f86b26a35e86139b991d42b61321cbc8fa68416.zip
Only allow the trust in the correct direction (per the flags).
(This used to be commit 2c7195429411d68bc66f4100659c622df4f5a20a)
-rw-r--r--source4/kdc/hdb-ldb.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 95c60e2c78..ef3a0bcb8a 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -45,6 +45,7 @@
#include "dsdb/samdb/samdb.h"
#include "librpc/ndr/libndr.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
+#include "librpc/gen_ndr/lsa.h"
#include "libcli/auth/libcli_auth.h"
#include "param/param.h"
#include "events/events.h"
@@ -56,9 +57,9 @@ enum hdb_ldb_ent_type
HDB_LDB_ENT_TYPE_KRBTGT, HDB_LDB_ENT_TYPE_TRUST, HDB_LDB_ENT_TYPE_ANY };
enum trust_direction {
- INBOUND,
- OUTBOUND,
- UNKNOWN
+ UNKNOWN = 0,
+ INBOUND = LSA_TRUST_DIRECTION_INBOUND,
+ OUTBOUND = LSA_TRUST_DIRECTION_OUTBOUND
};
static const char *realm_ref_attrs[] = {
@@ -751,6 +752,11 @@ static krb5_error_code LDB_trust_message2entry(krb5_context context, HDB *db,
password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
}
+ if (!password_val || !(trust_direction_flags & direction)) {
+ ret = ENOENT;
+ goto out;
+ }
+
ndr_err = ndr_pull_struct_blob_all(password_val, mem_ctx, private->iconv_convenience, &password_blob,
(ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {